Privacy notice

1. General provisions

1. This Privacy Policy defines the rules for processing personal data and the use of cookies and other similar technologies in connection with the use of the online store available at https://prezentowaprzystan.pl (hereinafter: the "Store").
2. Protecting Users' privacy is one of the Controller's top priorities. Personal data is processed in accordance with applicable legal provisions, in particular:
   • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
   • Act of 10 May 2018 on personal data protection,
   • Act of 18 July 2002 on the provision of electronic services,
   • Act of 12 July 2024 - Electronic Communications Law,
   • other applicable legal regulations.
3. Use of the Store implies acceptance of the rules described in this Privacy Policy to the extent that they apply to a given User.
4. This Privacy Policy is informative in nature and fulfills the information obligation resulting from Articles 13 and 14 of the GDPR.
5. The Controller applies appropriate technical and organizational measures to ensure the security of processed personal data and to protect it against unauthorized access, loss, destruction, or modification.

2. Personal data controller

1. The controller of personal data processed through the Store is:
   Bartosz Wójcik conducting business activity under the company name Bartosz Wójcik HUBIGA
   Zwierzchów 27K, 97-400 Bełchatów, Poland
   NIP (VAT ID): 7282440497 | REGON: 540303550
   hereinafter referred to as the "Controller".
2. The Controller determines the purposes and means of processing personal data in accordance with applicable legal provisions.
3. The Controller exercises due diligence to ensure that personal data is processed in accordance with the principles of:
   • lawfulness,
   • fairness,
   • transparency,
   • data minimization,
   • accuracy,
   • storage limitation,
   • integrity and confidentiality.

3. Contact details of the Controller

1. In matters related to the processing of personal data, you can contact the Controller:
   • Postal address: Bartosz Wójcik, HUBIGA, Zwierzchów 27K, 97-400 Bełchatów, Poland
   • E-mail address: mail@prezentowaprzystan.pl
   • Telephone: +48 799 103 842
2. The Controller responds to inquiries regarding personal data protection without undue delay, no later than within the deadlines arising from applicable legal provisions.

4. Scope of processed data

1. The Controller may process the following categories of personal data:
   • Identification data: first name, last name, company name, NIP (in the case of entrepreneurs).
   • Contact details: e-mail address, telephone number, delivery address, billing address.
   • Order data: Order number, purchase history, purchased Products, Order value, delivery method, payment method, information regarding complaints and returns.
   • Customer Account data: data provided during registration, login history, Account settings, saved addresses.
   • Data regarding personalized Products: In the case of orders involving personalized Products, the Controller may process materials provided by the Customer, in particular: photos, graphics, logos, inscriptions, dedications, designs, and other materials necessary to execute the Order.
   • Technical data: During the use of the Store, information regarding the following may be automatically collected: IP address, device identifier, browser type, operating system, language settings, date and time of visit, activity in the Store, cookies.
2. The Controller does not process special categories of personal data unless such an obligation arises from legal provisions or the data is voluntarily provided by the User.

5. Purposes and legal bases of data processing

1. The Controller processes personal data exclusively to the extent necessary to achieve specific purposes.

   • Purpose of Processing (Legal Basis)

     • Order Fulfillment (Article 6.1.b GDPR)

     • Customer Account Management (Article 6.1.b GDPR)

     • Contact with the Customer (Article 6.1.b or f GDPR)

     • Fulfillment of tax and accounting obligations (Article 6.1.c GDPR)

     • Complaint and refund processing (Article 6.1.c and b GDPR)

     • Exercising or defending legal claims (Article 6.1.f GDPR)

     • Statistics (Article 6.1.f GDPR)

     • Marketing of own services (Article 6.1.a or f GDPR (as applicable))

     • Newsletter sending (Article 6.1.a GDPR)

     • Product personalization (Article 6.1.b GDPR)

2. The Controller does not use personal data for purposes other than those specified above, unless it arises from applicable legal provisions or the User expresses separate consent.

6. Recipients of personal data

1. Personal data may be transferred exclusively to entities cooperating with the Controller to the extent necessary for the implementation of services.
2. In particular, recipients of data may be:
   • electronic payment operators (e.g., Autopay S.A., Stripe Payments Europe Ltd.),
   • courier companies and logistics operators delivering Orders,
   • parcel locker operators,
   • hosting service providers,
   • e-mail service providers,
   • IT service providers maintaining the Store,
   • accounting firm serving the Controller,
   • entities providing accounting, legal, or advisory services,
   • public authorities, if the obligation to transfer data results from legal provisions.
3. The Controller does not sell personal data or make it available to third parties for marketing purposes.
4. Each entity processing data on behalf of the Controller operates on the basis of an appropriate agreement and solely in accordance with the Controller's instructions, where legal provisions require the conclusion of such an agreement.

7. Data retention period

1. The Controller stores personal data for a period no longer than necessary to achieve the purpose for which it was collected. In particular:

   • Data Type (Retention Period)

     • Order Fulfillment (until the Agreement is executed and the deadlines for pursuing claims expire)

     • Accounting Documents (in accordance with applicable tax and accounting regulations)

     • Customer Account (until the Account is deleted or a request for data deletion is submitted, taking into account the Controller's legal obligations)

     • Complaints (for the period necessary to process them and the statute of limitations for any claims)

     • Correspondence (for the period necessary to respond and secure any claims)

     • Marketing Consents (until their withdrawal)

     • Analytical Data (in accordance with the settings of the analytical tools used or until an effective objection is filed, if applicable)

2. 2. After the expiry of the indicated periods, data is deleted or anonymized, unless applicable legal provisions require its further storage.

8. Rights of data subjects

1. Every person whose personal data is processed by the Controller is entitled to rights under the GDPR, in particular the right to:
   • access their personal data (My Account > GDPR Tools),
   • rectify inaccurate or incomplete data,
   • erasure of data ("right to be forgotten"), in cases provided for by law (My Account > GDPR Tools),
   • restriction of processing of data,
   • data portability, if the processing takes place on the basis of consent or contract and in an automated manner,
   • object to data processing based on the Controller's legitimate interest,
   • withdraw consent at any time if processing is based on consent, provided that withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal,
   • lodge a complaint with the President of the Personal Data Protection Office (UODO) if the person considers that the processing of their data violates applicable legal provisions.
2. The Controller exercises the rights of data subjects in accordance with the provisions of the GDPR and taking into account the exceptions provided for in applicable law.

9. Right to lodge a complaint with the President of the Personal Data Protection Office

1. If the User considers that the processing of their personal data violates the provisions of the GDPR or other applicable regulations regarding personal data protection, they have the right to lodge a complaint with the supervisory authority.
2. The competent supervisory authority in the territory of the Republic of Poland is:
   President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
   ul. Stawki 2, 00-193 Warsaw, Poland
3. Detailed information on how to lodge a complaint is available on the website of the Personal Data Protection Office.
4. Exercising the right to lodge a complaint does not restrict the possibility of pursuing rights before a competent court.

10. Voluntary provision of data

1. Providing personal data is voluntary, but in certain cases it is necessary to:
   • conclude and execute the Sales Agreement,
   • fulfill an Order,
   • create a Customer Account,
   • issue a sales document,
   • respond to a message sent via the contact form,
   • process a complaint or return.
2. Failure to provide data required to achieve the above-mentioned purposes may result in the inability to conclude the Sales Agreement or perform a specific service.
3. Providing data processed on the basis of consent, in particular for marketing purposes or related to receiving the newsletter, is completely voluntary. Consent may be withdrawn at any time.

11. Automated decision-making and profiling

1. The Controller does not make decisions regarding Users based solely on automated processing of personal data that produce legal effects concerning them or similarly significantly affect their situation.
2. If the User gives appropriate consents, data may be used to conduct statistical analysis and marketing activities based on the User's preferences.
3. Profiling may consist in particular of:
   • analyzing how the Store is used,
   • analyzing visited subpages,
   • analyzing purchase history,
   • analyzing the effectiveness of marketing campaigns.
4. Profiling is used solely to improve the quality of services provided, adapt the content presented in the Store, and conduct marketing activities if the User has given appropriate consent.
5. Profiling does not result in automated decision-making that produces legal effects regarding the User.

12. Data security

1. The Controller uses appropriate technical and organizational measures to ensure the security of personal data and protection against loss, destruction, unauthorized disclosure, or access by unauthorized persons.
2. In particular, the Controller applies:
   • encryption of connections using SSL/TLS protocol,
   • security measures for servers and IT systems,
   • data access control,
   • regular software updates,
   • measures protecting against unauthorized access,
   • data backups, if required to ensure business continuity.
3. The Controller continuously monitors the security of the IT infrastructure and takes actions aimed at mitigating the risk of security incidents.
4. Despite applying appropriate security measures, the Controller points out that using the Internet involves the risk of events beyond the Controller's control, such as third-party actions or ICT infrastructure failures.

13. Cookies and similar technologies

1. The Store uses cookies and other similar technologies to ensure the proper operation of the website, improve the quality of services provided, conduct statistical analyses, and—upon obtaining appropriate consent—carry out marketing activities.
2. Cookies are small text files saved on the User's terminal device while using the Store.
3. The following categories of cookies may be used in the Store:
   • Essential: enabling the proper functioning of the Store,
   • Functional: remembering User preferences,
   • Analytical: enabling the analysis of how the Store is used,
   • Marketing: used to present advertising content tailored to the User's interests.
4. Cookies other than essential are used only upon obtaining the User's consent, where applicable legal provisions require obtaining it.
5. Managing consent regarding cookies takes place via a tool provided during the first visit to the Store and accessible from the cookie preferences settings level.
6. The User may change cookie settings or withdraw previously granted consent at any time (Cookie Preferences).
7. Disabling certain cookies may limit the functionality of the Store.

14. Analytical and marketing tools

1. The Store may use analytical and marketing tools provided by third parties in order to:
   • analyze website traffic,
   • improve the operation of the Store,
   • measure the effectiveness of marketing activities,
   • create anonymous statistics regarding the use of the Store.
2. In particular, the Store may use the services of:
   • Google Analytics 4,
   • Google tools related to conversion measurement,
   • Google Consent Mode v2 technology,
   • user consent management systems.
3. Analytical tools use cookies or similar technologies in accordance with preferences expressed by the User.
4. Data used for analytical purposes is statistical in nature and does not serve the Controller to identify specific individuals, unless necessary to provide services to the User.
5. The use of marketing tools takes place solely in accordance with applicable legal regulations and taking into account consents granted by the User.

15. Links to other websites

1. The Store may contain links to websites operated by third parties.
2. The Controller is not responsible for the rules of personal data processing or the content of privacy policies applied by the owners of these websites.
3. The Controller recommends reading the privacy policy of each visited website before providing it with any personal data.

16. Changes to the Privacy Policy

1. The Controller reserves the right to make changes to this Privacy Policy in the event of:
   • changes in legal provisions,
   • changes in the operation of the Store,
   • introduction of new services or functionalities,
   • changes in the technologies used,
   • the need to adapt the document to decisions of supervisory authorities or court rulings.
2. The current version of the Privacy Policy is published on the Store's website on each occasion and applies from the date of its publication.
3. Changes to the Privacy Policy do not restrict Users' rights resulting from applicable legal provisions.
4. In the case of significant changes regarding the method of processing personal data, the Controller may inform Users of the changes via e-mail, a notice in the Store, or in another appropriate manner, if required by applicable legal provisions.